Cookie Policy
Last updated: 2026-09-01
The full list, so you can see exactly what is stored in your browser and why. This sits alongside our Privacy Policy, which covers everything else we hold.
Essential — always set
These make the site work. There is no way to switch them off and still have an account.
| Cookie | What it does | Kept for |
|---|---|---|
| Supabase session | Keeps you logged in. | Session / refresh window |
| One-time API key cookie | Shows your fresh API key once, right after signup. | Single use |
| zooq_consent | Remembers the choice you made in the cookie banner. | 1 year |
| zooq_ref | Which affiliate referred you, so the right person is paid. | 60 days |
The affiliate cookie is first-party and set regardless of your banner choice — it is how we pay the correct affiliate, it holds nothing but a short referral code, and it is never shared with an advertising network.
Analytics and advertising — you can decline
These load unless you click Decline. We use an opt-out model: if you have not answered the banner yet, they are running. Decline stops all of them, including the ad-click cookie.
| Cookie | What it does | Kept for |
|---|---|---|
| Google Tag Manager | Loads our analytics tags. Set by Google LLC. | Per Google |
| Microsoft Clarity | Aggregated session analytics — which pages people get stuck on. Set by Microsoft Corporation. | Per Microsoft |
| Meta Pixel | Measures whether an ad led to a signup. Set by Meta Platforms, Inc. | Per Meta |
| TikTok Pixel | Same, for TikTok ads. Set by TikTok Technology Limited. | Per TikTok |
| zooq_ttclid | The TikTok ad click that brought you here, so a later signup can be credited to the campaign. | 30 days |
| Affiracle | Credits the affiliate or publisher who referred you, so they are paid for the introduction. Set by Affiracle. | Per Affiracle |
Measurement from our servers
When you sign up or buy, we may send that event to Meta or TikTok from our own servers so the campaign can be credited. That message contains your email address and user id in hashed (SHA-256) form, the ad click id, and the IP address and user-agent recorded at signup. Never if you declined cookies, and never your name, phone number or API usage.
Change your choice
You can switch at any time, and it takes effect immediately — declining reloads the page so nothing keeps running.
You haven't made a choice yet — the banner is still showing.
You can also block or delete cookies in your browser settings. Blocking the essential ones will stop you being able to log in.
Questions
Email privacy@zooq.dev. Operator: Baldiga LTD, HaArbaa 30, Tel Aviv, Israel.